OAR 333-010-0050: Cancer Reporting Regulations: Confidentiality and Access to Data

This rule describes when confidential and privileged information collected and maintained by OSCaR may be shared and the process for obtaining aggregate non-confidential OSCaR information that is not publically available. (1) All identifying information regarding individual patients, health care facilities, clinical laboratories, and practitioners reported pursuant to ORS 432.510 and 432.520, OAR 333-010-0020, 333-010-0030 and 333-010-0032 shall be confidential and privileged. Except as required in connection with the administration or enforcement of public health laws or rules, no public health official, employee, or agent shall be examined in an administrative or judicial proceeding as to the existence or contents of data collected under the cancer registry system. (2) The information collected and maintained by OSCaR must be stored in secure locations, must be used solely for the purposes stated in ORS 432.510 and 432.520 and must not be further disclosed unless required by law, with the following exceptions: (a) When OSCaR has entered into reciprocal cooperative agreements with other states to exchange information on resident cases, as provided for in ORS 432.540. Such agreements must provide for obtaining data on Oregon resident cases diagnosed or treated out of state, and for reciprocal rights of other states to receive information on residents of those states diagnosed or treated in Oregon. Before entering into an agreement with any other state, OSCaR must determine that the other state has comparable confidentiality protections; (b) When disclosure to officers or employees of federal, state, or local government public health agencies is necessary to investigate or avoid a clear and immediate danger to other individuals or to the public generally; (c) When the Authority elects to contract with another agency for performance of a registry function the Authority will require the contractor to agree to use the information only for the purposes of the central cancer registry, to maintain the information securely, and to protect the information from unauthorized disclosure as referred to in OAR 333-010-0050(1). Before entering into any contract with another agency the Authority must determine the agency has comparable confidentiality protections; and (d) When the Authority deems that the information is necessary for others to conduct research in conformance with the purposes for which the data are collected. (3) Health care facilities shall have access to confidential and privileged data on any case submitted by that facility. When a patient has been seen for care by multiple health care facilities, OSCaR may share corrected or amended information among the reporting facilities due to the data standards and accuracy needed for each cancer case. (4) Practitioners shall have access to confidential and privileged data on any case submitted by that practitioner. When a patient has been seen for care of a case of cancer by multiple practitioners, OSCaR may share information on treatment and follow-up among the practitioners, provided that all participating practitioners have signed agreements with OSCaR to do so. (5) Access to non-confidential OSCaR data combined from multiple cancer cases and summarized as counts and rates that is not publically available is limited as follows: (a) Requestor shall make a formal request to OSCaR; (b) Requestor agrees to acknowledge OSCaR as the data source in any report or publication where the data is used; (c) County is the smallest unit of geography for which data will be released; and (d) Data will be suppressed based upon OSCaR’s current confidentiality standard.